fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661

Analysis

custom tags

antivmdropperobfuscated
max time kernel
46s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661.apk
Size 11.1MB
Sample260820-qckf2ade78
SHA256 fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661
MD5 8ebbed8b95fba632be8374c753767622
SHA1 afd4122b722bb84668434869ba514232b41f8e8d
SHA512 33e1f88248f6c219bc8e7c34d361729cd2b9a1cc1fbbe4c23a8f69d317b19bd43c0e17c781788516215dbb89a703e879c71eee36daee9516b38d3e3b518dcc35
SSDEEP 196608:Giz9af5CxnXKq0Pv5lI+A5RNG49SjVFDAk6fKDsnYeIaZcg/P7nC9zu:daf+nl0Pv5WAQSjrDu+s+gu9q
TLSH
T146C6225AF32CA02FD97B543349B6122102570D478E83AB93BA19724D29FB6C84F5EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

antivm collection credential_access defense_evasion discovery dropper evasion execution impact obfuscated persistence

Malware Config

Signatures

Encrypted or packed staged payload inside Android package 1 IoCs

Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

obfuscated dropper

resource	yara_rule
behavioral3/files/fstream-40.dat	ANDROID_Encrypted_Staged_Asset

Root, emulator and instrumentation-framework detection 2 IoCs

Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

evasion antivm

resource	yara_rule
behavioral3/files/fstream-7.dat	ANDROID_AntiAnalysis_Root_Emulator_Frida
behavioral3/files/fstream-37.dat	ANDROID_AntiAnalysis_Root_Emulator_Frida

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.cleaner.phoneclean.smartcleaner

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4936	com.cleaner.phoneclean.smartcleaner
/system_ext/framework/androidx.window.sidecar.jar	4936	com.cleaner.phoneclean.smartcleaner
/data/user/0/com.cleaner.phoneclean.smartcleaner/cache/1743000482668.jar	4936	com.cleaner.phoneclean.smartcleaner

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cleaner.phoneclean.smartcleaner

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cleaner.phoneclean.smartcleaner

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cleaner.phoneclean.smartcleaner

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cleaner.phoneclean.smartcleaner

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cleaner.phoneclean.smartcleaner

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cleaner.phoneclean.smartcleaner

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cleaner.phoneclean.smartcleaner

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cleaner.phoneclean.smartcleaner

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cleaner.phoneclean.smartcleaner

com.cleaner.phoneclean.smartcleaner
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4936

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1743000482668.jar

Path /data/data/com.cleaner.phoneclean.smartcleaner/cache/1743000482668.jar
Size 10KB
SHA256 aa1be7bbaa7ea4d5bec6cde9ffc9dcab84d50221dc68e06ce3e78fd99cb95950
MD5 ae04a0b601c5be1959455a9ff1939b69
SHA1 5ad114654fdd90f1beb702709b8db2bf309e8221
SHA512 f2516e360272813cd90742ca7f6f71f84179c1c33bb5fd0252f5c15d33fd080a8d71aad460cfdcdeb26082cb993c0b4c675fbfccc6dc244ef0bacaaa2e54acb4
SSDEEP 192:iPxAIJ2MOXILTskn4Q3wLMCpZyeluNAa4B26rUpXDRjZxFXUZYNpwi4mwclQl:ip93FLgrEwFZpl7a4IsKnUZYAiw
TLSH
T17F22AE790DAAD42DE026117AE31A52F7F644912408E8E2772E6EE0E80E634F7DAD4760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1743000482668.jar.cur.prof

Path /data/data/com.cleaner.phoneclean.smartcleaner/cache/oat/1743000482668.jar.cur.prof
Size 159B
SHA256 72dd20587d2c4ebb381481dfa19de9154708ac626e96c318e371af1562b831e3
MD5 8ad137428026f4f229605dd71935868a
SHA1 af8992a2a70567f21ccf5458dbf193dc2df8b578
SHA512 5b3bc862b02d24550a0b8bfe248b1b46ad82e29f6f59749316f7a0fedb6fa2bd600bd52debfdb4a637c04decc66277cecd55289a9f9e72a3cba0cbf18c04e768
TLSH
T106C08063715F5069907450D43ECF514EDB9606459D440B17D05D103993B1466D14E995
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/com.google.android.datatransport.events
Size 56KB
SHA256 bd6194dabfe09a05fffdf25d1d0126e605f1317a814e7ba7c7ff09ba068d085f
MD5 905120f49571d787d3e306790c96c284
SHA1 519e5200165d6772b48626d020bb700fcc1da5a3
SHA512 8131715b46c2c7670ae10b596ae1dfa043ab1e476a47b2d79ac8e644c661327e88ced2e75fc94a923e07d25130a6a8630a6df0775d84181bb6e34f71f379dc39
SSDEEP 48:TP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/bFn:7AMEX0wIyNjaPp
TLSH
T18243409F1DAC2210C5FE283ED7E243A35A3C53DF5726B2603D948DEA8FC246970255E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 12089a7da9d6c6f16b4d2cc7257ccadce496771bf7f8975be5a363f00f4b7dee
MD5 4d7155bd23104d270832ff5731cd5238
SHA1 71ea3a6a75a496d5dc239cde4c57022b2381bb6c
SHA512 977b931ac464cf5fb692eb53676dc93712a90b639cc5513397229231095639b64d4711dae264a6ce57812a4fb4718b10b7fbf163d896ccaf8838b0078fe21e22
SSDEEP 48:7MEfMtibYpZ9A0i0YpZqMbTW+rJmRU7QWqPyAWqtB3g59MENZBdUdndVd/729Iv4:7tfqyYRNYqkdmRU7pf9UAMEX0wIyNjaG
TLSH
T1F972C65EA83C1932C66E693EEBC05693AE3C43AF0B12A0706EA84CFB49C654D70314B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 7efee29ab7e34b3bd3ec5d125d91bc956703771f47579894f88ee0fd3c7c771a
MD5 a19c4e8dd1e96cc5f2b672680d0e54ab
SHA1 1a393a5589710d4c3851e55703ed87d28983580c
SHA512 605d5e40c0aaff6f4e971d3a96ee003fe6361f38e4a4a1480608ea17b32ca8e42f3107081cc454a1fe0563d23927180673f120dfa472b678cb448593ffdc41c7
SSDEEP 48:7MIQVKqqv3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSB:71nqEAMEX0wIyNjaB
TLSH
T11492439D192C2211C97E283FD3E24393593C63DF572791703E949CEE8DC2469B0356A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 4231847210b28395ba32465667551b06ad2e413b0e4bc9a359f126dab2f912fe
MD5 92f3ccbad80d1c276e45d9e1d2662897
SHA1 a6beecb8635beda8d08e86c39812758a829673e6
SHA512 2d294d037ad2709eadd1d05b563131276eadd95be79967759d66e3839887b3b7b624dd3f807655463823f32dd9bc901b40b54c430248110f6b82fffb7c09e2af
SSDEEP 48:7MjxFMq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSE:7N0AMEX0wIyNjaE
TLSH
T1D302339D1A3C2711C5BE287ED3E14353593C53DF572391703E948CEECDC2469B0255A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 7a1e2a45b325c83bbdd9044d196b706a0192f40e1970ecdef67664b4a4854d71
MD5 fa296a736b58bc76ace43039d1c6f553
SHA1 c3d227d1a3cfd65a5cd7918311b51d4165232d51
SHA512 dddb92b56475ef2b42bd215e9e29098a31d261d50e47caef3a1276b9df4f9b10f25eb88fb34132c80dc340c4c27e0d749f3b4cb4d58cb41ed6628ac753eb6a6f
SSDEEP 48:7M7lYQ60i0YpZpAmRU7QWqPyA9qP3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPO:7klYQJNYpAmRU7pfekAMEX0wIyNjal
TLSH
T15672845E2E3C1221C66E683EE7D152939A3C43CF0B12A1706A948CFA4DC655970714AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 bc23bed1d878fe375fe85fd3d3609401f0a85a79ddc28242cfc5525e1d109b64
MD5 8269751079df314581e54e1e7ef2ec46
SHA1 b690136191fc50272b8d955bbf776aac7927f18d
SHA512 f401bb78b589e613f8f6b0fa2b062f7e30f27416ee651f9d9237145f8708c43d25f617863b52770dc0ec3c21cc6378b84855583a51764a19d5fb9cc1ca6d76f2
SSDEEP 12:TLUEs7LzmzsRmBEyPbP/DvJ+/0Fl6gG1L:TLQHmz3GSP/DvJlFO
TLSH
T138722BCDAE20E603E167073A60CB93D61E38A11E4367965B3AA509789D932C8B052F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 2475f854f534ffbbb6c9acdd53704be38dea090eec92a0797a2f6dc056f46632
MD5 62ff83fe631c1f34d1a1bd82f3a2e6c0
SHA1 72118749d224782203bd2429b464858dc1c4bc20
SHA512 b88a62189d2ff332bedda0039bafd3f4c69ce0af71006a09ca077edd4800314b75b49e470374fe7eadb1bf6b2cf0e3ab56bc53c7f2d30298b6c88e08ac774b4d
SSDEEP 12:TL08EB7LzmzsRmBEyPbP/h1V49blqYFlpmqDbvJ+/0Fl6gG1L:TL0tHmz3GSP/h1V499FHFXvJlFO
TLSH
T18672468DBA24EA03E23B073D20C7A3C22D3DB11A076796067A510A2C5D43384A021F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 b1f82f2a9928d5831bfc52a04a67ed14c4a53d91b4740bcd5b4180658c91f413
MD5 65d0fead2ebd8a2d13eaacd456bbde2a
SHA1 9397c08a057e71ef34b90bc654cd32c2a8c9a9e6
SHA512 e463bcc89bc5bcb2e15e3597cb1817959815b563cf1ce2afcc85112a8f090787f08bfb6b7e1f7c8a87e0ad4aa12a9fa900b16b701f0197ae64b20841d2e65d02
SSDEEP 24:TLylxHmz3GSP/IXHM25x8I499FHFXvJlFO:TyxGKSP/Ys25uR5lf1O
TLSH
T1AC727B8ABA64EA43E12B0B3D50CBE3C3293C701B03A3D6067A121B2C2D833959120F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 3678a9984bff5c6c956d5061e6d1199c55a3eddff030969bb6b5c36fcd3c6744
MD5 0e3a8b8050d9c579125e803ef0ca250b
SHA1 59628f3bd98cae59250660a8a5660d9e7e7e0841
SHA512 5835095eed809fe1407cd2fa9cfef3ead02efc8a64bfb1470a989293b63d0825c72ba969ab512aab9b57d0807b00f480658ed6eb84aeb0ec3f9f8ed1bfbcc309
SSDEEP 24:TLgHmz3GSP/oVABXHM25x8I499FHFXvJlFO:TEGKSP/oVAxs25uR5lf1O
TLSH
T153728E8ABAA4E953E13B0B3C51CBE2C3283C700B0763C707B9121B1C2D833969120F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 942853dc2ee4a5e114af47facd2bbc8c3c85652dfc8011eb29d67f52098c34b0
MD5 bab35a1543fd320aa1d257feff33c72a
SHA1 ae0e5c0e3c74e334270b6e17c9998c1c06a8199e
SHA512 bcd1fa262b2a6349e0d6fd2ba4ad21cecf268d64e43894529b8cca886bbada676cacb1bd306ca8f6a4ef17db79f77d893c4f912ba652af63867825c4c23e5b91
SSDEEP 6:l9bNFlsls1QFP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WVyyyy1:TLiEG7LzmzsRmBEyPbP/W
TLSH
T1B672D88D8F106276CD234236348653977F28512A83675543FAB408606E53598B151E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.cleaner.phoneclean.smartcleaner/databases/google_app_measurement_local.db
Size 16KB
SHA256 176bf3749eda560fb75c6dfa37bee3f91dbf4962f55f2fffe6f076d0221c9dce
MD5 64f7c56ab6ee737cbade45a7500726b1
SHA1 5dbb6fdc784addb255ceeeae4dad57d138132aea
SHA512 ebd0d68b6e0f137c9d38172796eb0e6148e4b6fe86d12b82470db4735b1339bd6498cebf9d52854f69a517ac318d8b24d9fc8a4b04026d3b2b7fae2e8d30c763
SSDEEP 6:l9bNFlscls1dFP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/jqnb8:TL6UEr7LzmzsRmBEyPbP/uQ
TLSH
T1E47226CD8F10A603C523033770CA93950F28651E437BAA472BA408719E531C8F051F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download